Add UserAudit for user activation and deactivation

corehq/apps/reports/standard/users/reports.py

@@ -118,7 +118,11 @@ def _get_queryset(self):
             return UserHistory.objects.none()
 
         changed_by_user_slugs = self.request.GET.getlist(ChangedByUserFilter.slug)
-        changed_by_user_ids = self._get_user_ids(changed_by_user_slugs)
+        if changed_by_user_slugs:
+            changed_by_user_ids = self._get_user_ids(changed_by_user_slugs)
+        else:
+            # Show records that might be changed not by user in this domain
+            changed_by_user_ids = None
         # return empty queryset if no matching users were found
         if changed_by_user_slugs and not changed_by_user_ids:
             return UserHistory.objects.none()
@@ -141,7 +145,7 @@ def _get_users_es_query(self, slugs):
         )
 
     def _build_query(self, user_ids, changed_by_user_ids, user_property, actions, user_upload_record_id):
-        filters = Q(for_domain__in=self._for_domains())
+        filters = Q(for_domain__in=self._for_domains()) | Q(for_domain__isnull=True)
 
         if user_ids:
             filters = filters & Q(user_id__in=user_ids)

corehq/apps/sso/backends.py

@@ -4,6 +4,7 @@
 from django.utils.translation import gettext as _
 
 from corehq.apps.registration.models import AsyncSignupRequest
+from corehq.apps.users.util import log_user_change
 from dimagi.utils.web import get_ip
 
 from corehq.apps.analytics.tasks import (
@@ -21,6 +22,7 @@
 from corehq.apps.sso.utils.user_helpers import get_email_domain_from_username
 from corehq.apps.users.models import CouchUser, WebUser
 from corehq.const import (
+    USER_CHANGE_VIA_REACTIVATION,
     USER_CHANGE_VIA_SSO_INVITE,
     USER_CHANGE_VIA_SSO_NEW_USER,
 )
@@ -84,6 +86,11 @@ def authenticate(self, request, username, idp_slug, is_handshake_successful):
         if not is_new_user and not web_user.is_active:
             web_user.is_active = True
             web_user.save()
+            log_user_change(by_domain=None, for_domain=None,
+                            by_domain_required_for_log=False, for_domain_required_for_log=False,
+                            couch_user=web_user, changed_by_user=web_user,
+                            fields_changed={'is_active': web_user.is_active},
+                            changed_via=USER_CHANGE_VIA_REACTIVATION)
             request.sso_new_user_messages['success'].append(
                 _("User account for {} has been re-activated.").format(web_user.username)
             )

corehq/apps/sso/tasks.py

@@ -21,7 +21,9 @@
 from corehq.apps.sso.utils.user_helpers import convert_emails_to_lowercase
 from corehq.apps.users.models import WebUser
 from corehq.apps.users.models import HQApiKey
+from corehq.apps.users.util import SYSTEM_USER_ID, log_user_change
 from django.contrib.auth.models import User
+from corehq.const import USER_CHANGE_VIA_SSO_DEACTIVATION
 from corehq.sql_db.util import paginate_query
 from django.db import router
 from django.db.models import Q
@@ -163,6 +165,11 @@ def auto_deactivate_removed_sso_users():
                 if user and user.is_active:
                     user.is_active = False
                     user.save()
+                    log_user_change(by_domain=None, for_domain=None,
+                            by_domain_required_for_log=False, for_domain_required_for_log=False,
+                            couch_user=user, fields_changed={'is_active': user.is_active},
+                            changed_via=USER_CHANGE_VIA_SSO_DEACTIVATION,
+                            changed_by_user=SYSTEM_USER_ID)
 
 
 def send_deactivation_skipped_email(idp, failure_code, error=None, error_description=None):

corehq/const.py

@@ -36,5 +36,8 @@
 USER_CHANGE_VIA_SSO_NEW_USER = "sso_new"
 USER_CHANGE_VIA_SSO_INVITE = "sso_invitation"
 USER_CHANGE_VIA_AUTO_DEACTIVATE = "auto_deactivate"
+USER_CHANGE_VIA_REACTIVATION = "reactivation"
+USER_CHANGE_VIA_SSO_DEACTIVATION = "sso_deactivation"
+
 
 LOADTEST_HARD_LIMIT = 500_000  # max cases a loadtest user can sync